Microsoft Releases Emergency Patch for ASP.NET Core Vulnerability on Linux and macOS – Immediate Action Required

Overview of the Emergency Patch

Microsoft has issued an out-of-band security update for ASP.NET Core to address a high-severity vulnerability that could allow unauthenticated attackers to gain full SYSTEM-level access on systems running Linux or macOS. The flaw, identified as CVE-2026-40372, resides in the Microsoft.AspNetCore.DataProtection NuGet package, a core component of the ASP.NET Core framework used to protect sensitive data such as authentication tokens and cookies.

The vulnerability affects package versions 10.0.0 through 10.0.6 inclusive. Microsoft released the patch on Tuesday evening, urging all developers and administrators to apply it immediately.

Vulnerability Details

The security flaw originates from an incorrect validation of cryptographic signatures during the HMAC (Hash-Based Message Authentication Code) validation process. HMAC is a mechanism used to verify both the integrity and authenticity of data exchanged between a client and a server – for example, in authentication cookies or API tokens.

Under normal circumstances, only the legitimate server can generate valid HMAC signatures. But due to the faulty signature verification, an unauthenticated attacker can craft forged authentication payloads that pass validation. This enables them to impersonate any user, including privileged accounts, and ultimately execute code with SYSTEM privileges – the highest level of access on a Windows machine or equivalent on Linux/macOS.

Attack Vector

The attack does not require any prior authentication or user interaction. An attacker simply sends a specially crafted request to an application using a vulnerable version of the DataProtection package. The bug can be exploited remotely over the network, making it especially dangerous for internet-facing applications.

Impact and Risk: Full System Compromise

If exploited, the vulnerability gives an attacker complete control over the underlying machine. This includes the ability to:

• Install malicious programs
• View, modify, or delete data
• Create new accounts with full privileges
• Move laterally within the network

Because ASP.NET Core is widely used for cross-platform applications, the risk extends to any organization running Linux or macOS servers with the affected package versions.

Critical Warning: Forged Credentials Survive Patching

One of the most alarming aspects of CVE-2026-40372 is that simply updating the package does not fully remediate existing compromises. If an attacker exploited the vulnerability before the patch was applied, they may have generated forged authentication credentials that remain valid even after the vulnerable code is replaced.

These persistent credentials reside in the system's data protection key ring – the repository where ASP.NET Core stores cryptographic keys used for generating and validating authentication tickets. Unless the key ring is explicitly purged and new keys are generated, the attacker's tokens continue to work, keeping the backdoor open.

As Microsoft warned, “Devices may still be compromised if authentication credentials created by a threat actor aren’t purged.” This means that applying the patch is only the first step.

Mitigation Steps: How to Fully Secure Your Systems

To address both the vulnerability and the credential persistence issue, follow these steps:

1. Update the NuGet package to version 10.0.7 or later (the fixed version released on Tuesday). Use your package manager to update Microsoft.AspNetCore.DataProtection in all affected projects.
2. Purge the data protection key ring to invalidate any potentially forged credentials. This can be done by:
   • Deleting the key ring directory (default location: %LOCALAPPDATA%\ASP.NET\DataProtection-Keys on Windows, ~/.aspnet/DataProtection-Keys on Linux/Mac).
   • Or, if using a custom key storage (e.g., Azure Key Vault, Redis), replace or invalidate existing keys.
3. Regenerate and redistribute keys immediately after purging. Use the dotnet dev-certs https --clean command for development environments, or rely on your key management system for production.
4. Audit your systems for signs of prior exploitation: look for unexpected user accounts, unusual network connections, or suspicious activity logs. Since SYSTEM-level access could have been obtained, assume full compromise if any indicators are found.
5. Reissue all authentication tokens to force users to log in again with newly generated credentials.

Conclusion: Act Now to Prevent Exploitation

CVE-2026-40372 is a high-severity vulnerability that bypasses one of the fundamental security mechanisms in ASP.NET Core – cryptographic signature verification. Given the ease of exploitation (no authentication required) and the severe impact (full SYSTEM privileges), this patch should be treated as an emergency.

Remember: patching alone is not enough. You must also take the additional step of purging the data protection key ring to eliminate any pre-existing forged credentials. Delaying either action leaves your systems exposed to complete takeover.

For more details, refer to the official Microsoft Security Response Center advisory. For guidance on key management, see the ASP.NET Core Data Protection documentation.